Tier the use, not the tool.
The same Low / Medium / High scale from Day 13, now tied to how much checking each tier needs before it goes live.
Low
Self-Serve
Internal, low stakes, easy to check. Allowed within policy on approved tools.
Medium
Owner Sign-Off
Customer-facing or business-sensitive. Needs an owner's approval and human review.
High
Formal Approval
Decisions about people, personal info at scale, or AI taking actions. Needs an impact assessment and monitoring.
Tier the use, not the tool.